sysmon_stopped2 by Pablo Delgado on October 31, 2017 in Previous article Monitoring the monitor: Sysmon status